@skaile/workspaces 5.15.1 → 5.17.0

package/dist/{chunk-R37L4BNR.js → chunk-W44KA24A.js}

@@ -1,20 +1,21 @@
-import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, getStoreManifestsDir, missingLibraryDirMessage } from './chunk-OOQ5Q75W.js';
-import { SEMVER_RE, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-NKDSU4Q7.js';
-import { installTargetOf, canonicalEntryRef, deployedAssetDrift, deployAll, removeAsset, diffDeployedAgent, createScaffold, installAgent } from './chunk-WWUWMOX2.js';
+import { unregisteredLibraryNames, renamedLibraryName, resolveConfig, RemoteCatalogSource, OfflineError, describeCatalogError, CatalogHttpError, scanUnlistedAssets, storeManifestFile, missingLibraryDirMessage } from './chunk-D3PU3C6F.js';
+import { SEMVER_RE, invalidSemverMessage, flowFileNameError, readManifestSourceConfig, discoverAssetsInTree, isManifestMode } from './chunk-ES6ARJPQ.js';
+import { installTargetOf, readKeptLegacyCopies, writeKeptLegacyCopies, canonicalEntryRef, diffDeployedAgent, deployedAssetDrift, deployAll, removeAsset, createScaffold, installAgent } from './chunk-FSLVMZXR.js';
 import { appendHistory, getRecentHistory, clearHistory } from './chunk-KTBKW2FI.js';
 import { commitChanges } from './chunk-UQ6LFBPZ.js';
-import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-BV7NLPI6.js';
-import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-4QINFQ27.js';
-import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-X7DIT65W.js';
-import { deployedBase, deployedDir, isDeployed, deployedPaths } from './chunk-D54T2F54.js';
-import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID, resolveAgentDefinitionDir, storeManifestSlug } from './chunk-J76LDUDS.js';
+import { driverTargetSupportsAgents, CODEX_IDENTITY_DIR } from './chunk-6GSE63K2.js';
+import { isScaffoldBody } from './chunk-YK3XLEQJ.js';
+import { resolveConfiguredDriverTarget, GLOBAL_INSTALL_DIR_NAME, resolveLibraryDir, buildLibraryLockEntries, computeHash, buildLockFile, writeLock, readLock, verifyLock, mergeLockFile, resyncLockSources, extractForPatch, generatePatch, savePatch, applyPatch, LOCK_SCHEMA_VERSION } from './chunk-PIC23DDE.js';
+import { resolveRuntimeAssets, factoryAssetRoots } from './chunk-5RDZ5JHH.js';
+import { deployedBase, isDeployed, deployedPaths, deployedDir } from './chunk-D54T2F54.js';
+import { resolveSkWorkspaceConfig, effectiveAgentInstances, loadMcpServerDeclarations, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, getGlobalCacheDir, sourceCacheKey, getRepoCommit, matchPin, buildProvenanceIndex, coerceVersion, sourceShortName, readLinks, isCommitOnRemote, resolveAll, agentSourceCacheDir, ensureRepo, scanRepo, SKAILE_YAML_DEFAULT, checkRepoStatus, resolveAgentDefinitionDir, resolveAsset, MAX_PRESET_DEPTH, PresetDepthError, DEFAULT_AGENT_INSTANCE_ID } from './chunk-ZVZTCDUN.js';
 import { globalSkaileDir, globalCacheRoot, migrateLegacyDir } from './chunk-L5VSIPQD.js';
-import { DRIVER_TARGETS } from './chunk-IG5LZ3WU.js';
-import { loadSkPublishManifest } from './chunk-ANSZULXH.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements } from './chunk-SP5NGNBV.js';
-import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-VY6NTFE7.js';
+import { DRIVER_TARGETS, SUPPORTED_DRIVER_TARGETS } from './chunk-IG5LZ3WU.js';
+import { listAssetFiles, loadSkPublishManifest } from './chunk-H7R7R5BN.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirements, readAssetBody } from './chunk-YW2BNDSE.js';
+import { parseAssetRef, parseAssetRefLoose, assetRefToStr, slugifyAssetName, depToStr, parseDep } from './chunk-FT4ZHLYR.js';
 import { spawnSync } from 'child_process';
-import { existsSync, rmSync, readdirSync, readFileSync, lstatSync, unlinkSync, mkdirSync, writeFileSync } from 'fs';
+import { existsSync, rmSync, readFileSync, readdirSync, lstatSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';
 import path, { resolve, dirname, sep, join, relative, posix } from 'path';
 import { gt } from 'semver';
 import { parse, stringify } from 'yaml';
@@ -266,6 +267,18 @@ async function defaultFetchPayload(url) {
   if (!res.ok) throw new Error(`${url} answered ${res.status}`);
   return new Uint8Array(await res.arrayBuffer());
 }
+async function markEsmPayload(dir, dest, bytes) {
+  if (!dest.endsWith(".js")) return;
+  const text = Buffer.from(bytes).toString("utf-8");
+  if (!/^\s*(import\s*[\w{*"']|export\s|export\s*\{)|\bimport\.meta\b/m.test(text)) return;
+  try {
+    await fs.writeFile(path.join(dir, "package.json"), `${JSON.stringify({ type: "module" })}
+`, {
+      flag: "wx"
+    });
+  } catch {
+  }
+}
 async function ensurePayload(projectDir, decl, fetchPayload) {
   const payload = decl.payload;
   if (!payload) return void 0;
@@ -284,10 +297,15 @@ async function ensurePayload(projectDir, decl, fetchPayload) {
   if (!dir) return `payload of '${decl.id}' has no usable directory name`;
   const file = path.join(dir, dest);
   const sha = (bytes2) => createHash("sha256").update(bytes2).digest("hex");
+  let existing;
   try {
-    if (sha(await fs.readFile(file)) === payload.sha256) return void 0;
+    existing = await fs.readFile(file);
   } catch {
   }
+  if (existing && sha(existing) === payload.sha256) {
+    await markEsmPayload(dir, dest, existing);
+    return void 0;
+  }
   let bytes;
   try {
     bytes = await fetchPayload(payload.url);
@@ -307,6 +325,7 @@ async function ensurePayload(projectDir, decl, fetchPayload) {
   } catch (err) {
     return `payload ${dest} could not be written: ${err instanceof Error ? err.message : String(err)}`;
   }
+  await markEsmPayload(dir, dest, bytes);
   return void 0;
 }
 async function removePayloadDir(projectDir, id) {
@@ -359,6 +378,28 @@ async function writeJson(p, value) {
   await fs.writeFile(p, `${JSON.stringify(value, null, 2)}
 `);
 }
+function notedSkipsPath(projectDir) {
+  return path.join(projectDir, ".skaile", "mcp-skipped.json");
+}
+async function readNotedSkipsState(projectDir) {
+  try {
+    return JSON.parse(await fs.readFile(notedSkipsPath(projectDir), "utf-8"));
+  } catch {
+    return { version: 1 };
+  }
+}
+async function readNotedSkips(projectDir, target) {
+  const noted = (await readNotedSkipsState(projectDir)).targets?.[target];
+  return noted && typeof noted === "object" ? noted : {};
+}
+async function writeNotedSkips(projectDir, target, before, skipped) {
+  const now = Object.fromEntries(skipped.map((s) => [s.id, s.reason]));
+  if (JSON.stringify(now) === JSON.stringify(before)) return;
+  const targets = { ...(await readNotedSkipsState(projectDir)).targets ?? {} };
+  if (skipped.length > 0) targets[target] = now;
+  else delete targets[target];
+  await writeJson(notedSkipsPath(projectDir), { version: 1, targets });
+}
 async function readManagedIds(projectDir, target) {
   const state = await readJsonStrict(managedStatePath(projectDir));
   const ids = state?.targets?.[target];
@@ -372,6 +413,16 @@ async function writeManagedIds(projectDir, target, ids) {
   else delete targets[target];
   await writeJson(p, { version: 1, targets });
 }
+async function removeEmptyLedger(projectDir) {
+  const p = managedStatePath(projectDir);
+  const state = await readJsonStrict(p);
+  if (!state || Object.keys(state.targets ?? {}).length > 0) return;
+  await fs.rm(p, { force: true });
+  try {
+    await fs.rmdir(path.dirname(p));
+  } catch {
+  }
+}
 function mergeServers(existing, renderable, managedIds, warn, configLabel) {
   const next = { ...existing };
   const managed = new Set(managedIds);
@@ -401,15 +452,19 @@ async function renderMcpServerConfig(projectDir, driverTarget, opts) {
   const declarations = await loadMcpServerDeclarations(projectDir);
   const skipped = [];
   const renderable = /* @__PURE__ */ new Map();
+  const noted = await readNotedSkips(projectDir, driverTarget);
   for (const decl of declarations) {
     const reason = skipReason(decl) ?? await ensurePayload(projectDir, decl, opts?.fetchPayload ?? defaultFetchPayload);
     if (reason) {
       skipped.push({ id: decl.id, reason });
-      warn(`MCP server "${decl.id}" not written to ${relConfig}: ${reason}`);
+      if (noted[decl.id] !== reason) {
+        warn(`MCP server "${decl.id}" not written to ${relConfig}: ${reason}`);
+      }
       continue;
     }
     renderable.set(decl.id, buildEntry(decl, projectDir));
   }
+  await writeNotedSkips(projectDir, driverTarget, noted, skipped);
   const managedIds = await readManagedIds(projectDir, driverTarget);
   const existingFile = await readJsonStrict(configPath);
   if (renderable.size === 0 && managedIds.length === 0 && !existingFile) {
@@ -433,6 +488,11 @@ async function renderMcpServerConfig(projectDir, driverTarget, opts) {
   if (!ledgerStale && JSON.stringify(next) === JSON.stringify(existingServers) && existingFile) {
     return { path: configPath, written: false, servers: owned, removed, skipped };
   }
+  if (removed.length > 0 && Object.keys(next).length === 0 && Object.keys(file).every((k) => k === "mcpServers")) {
+    await fs.rm(configPath, { force: true });
+    if (owned.length === 0) await removeEmptyLedger(projectDir);
+    return { path: configPath, written: true, servers: owned, removed, skipped };
+  }
   await writeJson(configPath, { ...file, mcpServers: next });
   return { path: configPath, written: true, servers: owned, removed, skipped };
 }
@@ -465,7 +525,7 @@ function libraryRemoteUrl(library) {
   return url ? withoutUrlSecrets(url) : void 0;
 }
 function storeOverlayPathForUrl(url) {
-  return join(getStoreManifestsDir(), `${storeManifestSlug(url)}.yaml`);
+  return storeManifestFile(url);
 }
 function pinsBySlug(sources) {
   return new Map(sources.map((s) => [sourceCacheKey(s.url), s.pin]));
@@ -650,6 +710,19 @@ function newestLibraryDef(snap, libraryName, id) {
   }
   return best;
 }
+var PSEUDO_VERSION_PREFIX = "0.0.0-sha.";
+function isPseudoVersion(version) {
+  return version.startsWith(PSEUDO_VERSION_PREFIX);
+}
+function libraryAssetVersion(snap, libraryName, id, declared) {
+  if (declared) return declared;
+  const lib = snap?.libraries.find((l) => l.name === libraryName);
+  if (lib?.ownership === "reader" && "url" in lib.backendConfig) {
+    const commit = getRepoCommit(lib.path);
+    if (commit) return `${PSEUDO_VERSION_PREFIX}${commit.slice(0, 7)}`;
+  }
+  return newestLibraryDef(snap ?? null, libraryName, id)?.version;
+}
 function libraryPreference(isDefaultLib, rank) {
   return (a, b) => {
     const va = coerceVersion(a.entry.version ?? "");
@@ -676,6 +749,20 @@ function qualifyDepRef(ref, fallback) {
     pin
   });
 }
+function scaffoldBodyRefs(entries, deployed) {
+  const out = [];
+  for (const e of entries) {
+    const ref = canonicalEntryRef(e);
+    if (!deployed.includes(ref) || !e.source) continue;
+    try {
+      if (isScaffoldBody(e.kind, readAssetBody(e.source, readFileSync(e.source, "utf8")))) {
+        out.push(ref);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
 function libraryEntryDepRefs(e) {
   const publisher = e.publisher ?? "";
   const refs = /* @__PURE__ */ new Set();
@@ -834,6 +921,7 @@ function libraryMoves(prev, next) {
       if (o.kind !== id.kind || o.name !== id.name || o.publisher !== id.publisher) continue;
       const from = before.library;
       if (!from || from.installed || from.name === to.name) continue;
+      if (renamedLibraryName(from.name) === to.name) continue;
       out.push({ ref: `${id.kind}:@${id.publisher}/${id.name}`, from: from.name, to: to.name });
       break;
     }
@@ -897,6 +985,27 @@ var MissingManifestError = class extends Error {
   }
   projectDir;
 };
+function unlistedAssetMessage(ref, library, libPath, ownership) {
+  const head = `${ref} is in library "${library}" but not listed in its skaile.manifest.yaml, so only part of its files would be deployed.`;
+  const segments = libPath.split(/[\\/]/);
+  const isReader = ownership === "reader" || segments.some((s, i) => s === "cache" && segments[i + 1] === "sources");
+  return isReader ? `${head} "${library}" is a read-only source clone: add it to skaile.manifest.yaml in the source repo and push, then run \`skaile source sync\`.` : `${head} Run \`skaile library index ${library}\`, then add it again.`;
+}
+function pathEntryExists(p) {
+  try {
+    lstatSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isSymlink(p) {
+  try {
+    return lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
 var FACTORY_SOURCE_URL = "https://github.com/skaile-ai/ai-assets";
 function resolveFactoryAssetsDir() {
   for (const dir of factoryAssetRoots()) {
@@ -920,6 +1029,40 @@ function resolveFactorySource() {
   factorySourceCache = dir && publisher ? { dir, publisher } : null;
   return factorySourceCache;
 }
+function legacyOmpPaths(component, name) {
+  const modern = `${sep}.omp${sep}agent${sep}`;
+  return deployedPaths(component, name, "omp", true).filter((path2) => path2.includes(modern)).map((path2) => path2.replace(modern, `${sep}.omp${sep}`)).filter(pathEntryExists);
+}
+function sameBytes(a, b) {
+  try {
+    const sa = lstatSync(a);
+    const sb = lstatSync(b);
+    if (sa.isSymbolicLink() || sb.isSymbolicLink()) return false;
+    if (sa.isDirectory() !== sb.isDirectory()) return false;
+    if (!sa.isDirectory()) return readFileSync(a).equals(readFileSync(b));
+    const na = readdirSync(a).sort();
+    const nb = readdirSync(b).sort();
+    return na.length === nb.length && na.every((n, i) => n === nb[i] && sameBytes(join(a, n), join(b, n)));
+  } catch {
+    return false;
+  }
+}
+var ENTRY_HARNESSES_KEY = "global_asset_harnesses";
+function sameList(a, b) {
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+function decodeEntryHarnesses(value) {
+  const out = {};
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return out;
+  for (const [key, list] of Object.entries(value)) {
+    if (!Array.isArray(list)) continue;
+    const valid = list.filter(
+      (h) => SUPPORTED_DRIVER_TARGETS.includes(h)
+    );
+    if (valid.length > 0) out[key] = [...new Set(valid)];
+  }
+  return out;
+}
 var AssetManager = class {
   /** Resolved absolute path to the workspace root. */
   projectDir;
@@ -932,6 +1075,8 @@ var AssetManager = class {
   _knownKinds;
   /** Explicit global-harness override (global mode only); else auto-resolved. */
   harnessesOverride;
+  legacyCopiesRemoved = [];
+  legacyCopiesKept = [];
   /** Injected catalog fetcher (tests / custom); falls back to a built one. */
   injectedStoreFetcher;
   /** Injected byte fetcher for store staging; falls back to GitHub. */
@@ -1001,11 +1146,140 @@ var AssetManager = class {
   targetHarnesses() {
     if (!this.global) return [this.driverTarget];
     if (this.harnessesOverride && this.harnessesOverride.length > 0) return this.harnessesOverride;
+    return this.defaultGlobalHarnesses();
+  }
+  /** The global harness set without a `--harness` filter (see {@link AssetManager.targetHarnesses}). */
+  defaultGlobalHarnesses() {
     const resolved = resolveGlobalHarnesses();
     if (resolveGlobalSkWorkspaceConfig().global_harnesses?.length) return resolved;
     const configured = resolveConfiguredDriverTarget(this.projectDir);
     return configured && !resolved.includes(configured) ? [...resolved, configured] : resolved;
   }
+  /**
+   * `global_asset_harnesses:` of `~/.skaile/skaile.yaml`: the harnesses `add --global --harness`
+   * limited an entry to, keyed by the declared ref without its pin. An entry with no row goes to
+   * every global harness. Global mode only.
+   */
+  readEntryHarnesses() {
+    if (!this.global) return {};
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return {};
+    try {
+      const raw = parse(readFileSync(configPath, "utf8"));
+      return decodeEntryHarnesses(raw?.[ENTRY_HARNESSES_KEY]);
+    } catch {
+      return {};
+    }
+  }
+  /** The harnesses recorded for `kind:name` (`publisher` must agree when both sides have one). */
+  entryHarnessRecord(kind, name, publisher) {
+    const wantPub = publisher?.replace(/^@/, "");
+    for (const [key, harnesses] of Object.entries(this.readEntryHarnesses())) {
+      const id = parseAssetRefLoose(key);
+      if (!id || id.kind !== kind || id.name !== name) continue;
+      const havePub = id.publisher?.replace(/^@/, "");
+      if (wantPub === void 0 || havePub === void 0 || havePub === wantPub) return harnesses;
+    }
+    return void 0;
+  }
+  /** Keep the entries a recorded `--harness` limit sends to `target` (all of them in project mode). */
+  entriesForHarness(entries, target) {
+    if (!this.global || Object.keys(this.readEntryHarnesses()).length === 0) return entries;
+    return entries.filter((e) => {
+      const recorded = this.entryHarnessRecord(e.kind, e.name, e.publisher);
+      return !recorded || recorded.includes(target);
+    });
+  }
+  /**
+   * Set (or, with `harnesses` undefined, clear) the harness row of `ref` in the parsed
+   * `~/.skaile/skaile.yaml` `raw`. Returns whether `raw` changed.
+   */
+  setEntryHarnessRow(raw, ref, harnesses) {
+    const id = parseAssetRefLoose(ref);
+    if (!id) return false;
+    const key = `${id.kind}:${id.publisher ? `@${id.publisher.replace(/^@/, "")}/` : ""}${id.name}`;
+    const rows = decodeEntryHarnesses(raw[ENTRY_HARNESSES_KEY]);
+    let changed = false;
+    for (const k of Object.keys(rows)) {
+      const other = parseAssetRefLoose(k);
+      if (other && other.kind === id.kind && other.name === id.name && (!other.publisher || !id.publisher || other.publisher === id.publisher)) {
+        if (k === key && harnesses && sameList(rows[k], harnesses)) continue;
+        delete rows[k];
+        changed = true;
+      }
+    }
+    if (harnesses && harnesses.length > 0 && !(key in rows)) {
+      rows[key] = [...harnesses];
+      changed = true;
+    }
+    if (!changed) return false;
+    if (Object.keys(rows).length === 0) delete raw[ENTRY_HARNESSES_KEY];
+    else raw[ENTRY_HARNESSES_KEY] = rows;
+    return true;
+  }
+  /**
+   * Delete the copies a 5.12.0 global install left in `~/.omp/skills`, `~/.omp/agents`,
+   * `~/.omp/prompts` and `~/.omp/contracts` (omp reads `~/.omp/agent/<dir>`) for the assets just
+   * deployed into omp's new folder, and remember them for {@link takeLegacyCopiesRemoved} (p744).
+   */
+  sweepLegacyOmpCopies(entries) {
+    if (!this.global || !this.targetHarnesses().includes("omp")) return;
+    const locked = new Set(Object.keys(this.tryReadLock()?.assets ?? {}));
+    const kept = readKeptLegacyCopies();
+    for (const entry of entries) {
+      const component = this.installTarget(entry.kind);
+      if (!component || !entry.name) continue;
+      if (!isDeployed(component, entry.name, "omp", true)) continue;
+      const modern = deployedPaths(component, entry.name, "omp", true).filter(
+        (p) => p.includes(`${sep}.omp${sep}agent${sep}`)
+      );
+      const recorded = [...locked].some((key) => {
+        const id = parseCanonicalLockKey(key);
+        return id.kind === entry.kind && id.name === entry.name;
+      });
+      for (const legacy of legacyOmpPaths(component, entry.name)) {
+        const twin = modern.find(
+          (p) => p === legacy.replace(`${sep}.omp${sep}`, `${sep}.omp${sep}agent${sep}`)
+        );
+        if (kept.has(legacy)) continue;
+        if (recorded || twin !== void 0 && sameBytes(legacy, twin)) {
+          rmSync(legacy, { recursive: true, force: true });
+          this.legacyCopiesRemoved.push(legacy);
+        } else {
+          this.legacyCopiesKept.push(legacy);
+          kept.add(legacy);
+          writeKeptLegacyCopies(kept);
+        }
+      }
+    }
+  }
+  /** The old omp copies the deploys since the last call kept, as skaile did not write them. */
+  takeLegacyCopiesKept() {
+    return this.legacyCopiesKept.splice(0);
+  }
+  /**
+   * The old `~/.omp/<dir>/<name>` copies of the globally locked assets that are still on disk
+   * (a 5.12.0 install wrote them; omp reads `~/.omp/agent/<dir>`). Global mode only. `check`,
+   * `doctor` and `clean` with `--global` report or remove them (p911).
+   */
+  staleLegacyOmpCopies() {
+    if (!this.global) return [];
+    const out = [];
+    const kept = readKeptLegacyCopies();
+    for (const key of Object.keys(this.tryReadLock()?.assets ?? {})) {
+      const id = parseCanonicalLockKey(key);
+      const component = id.kind && id.name ? this.installTarget(id.kind) : void 0;
+      if (!component || !id.name) continue;
+      for (const path2 of legacyOmpPaths(component, id.name)) {
+        if (!kept.has(path2)) out.push({ ref: key, path: path2 });
+      }
+    }
+    return out;
+  }
+  /** The old omp copies the deploys since the last call removed (see {@link sweepLegacyOmpCopies}). */
+  takeLegacyCopiesRemoved() {
+    return this.legacyCopiesRemoved.splice(0);
+  }
   /**
    * The harnesses `add` / `install` deploy into: `[driverTarget]` for a project, the global
    * harness set (see {@link AssetManager.targetHarnesses}) for a global manager.
@@ -1296,12 +1570,13 @@ var AssetManager = class {
           continue;
         }
         if (snap === void 0) snap = await this.loadLibraryIndex();
-        const def = newestLibraryDef(snap, c.library, {
-          kind: c.entry.kind,
-          publisher: c.entry.publisher ?? "",
-          name: c.entry.name
-        });
-        pool.push(def?.version ? { ...c, entry: { ...c.entry, version: def.version } } : c);
+        const version = libraryAssetVersion(
+          snap,
+          c.library,
+          { kind: c.entry.kind, publisher: c.entry.publisher ?? "", name: c.entry.name },
+          void 0
+        );
+        pool.push(version ? { ...c, entry: { ...c.entry, version } } : c);
       }
       let candidates = pool.filter((c) => !pin || matchPin(pin, c.entry.version ?? ""));
       let lockedLibrary;
@@ -1336,14 +1611,32 @@ var AssetManager = class {
       const hit = candidates[0];
       if (hit.entry.version && !SEMVER_RE.test(hit.entry.version)) {
         throw new Error(
-          `${canonicalEntryRef(hit.entry)} (library ${hit.library}): version "${hit.entry.version}" is not valid semver. Set a valid version in the asset file and run \`skaile library index ${hit.library}\`.`
+          `${canonicalEntryRef(hit.entry)} (library ${hit.library}): ${invalidSemverMessage(hit.entry.version)}. Set a valid version in the asset file and run \`skaile library index ${hit.library}\`.`
+        );
+      }
+      const flowFileError = hit.entry.kind === "flow" && hit.entry.source ? flowFileNameError({ id: hit.entry.name }, hit.entry.source.split(/[\\/]/).pop()) : void 0;
+      if (flowFileError) {
+        throw new Error(
+          `${canonicalEntryRef(hit.entry)} (library ${hit.library}): ${flowFileError}. Fix it, then run \`skaile library index ${hit.library}\`.`
         );
       }
       if (!opts.quiet && !opts.library) {
+        const hashOf = (c) => {
+          const libPath = libraryDir.get(c.library);
+          return libPath ? libraryDiskHashes(libPath, diskHashes, this.registry).get(
+            `${c.entry.kind}:${c.entry.name}`
+          ) : void 0;
+        };
+        const hitHash = hashOf(hit);
+        const sameVersionDiffers = candidates.filter((c) => c.library !== hit.library && c.entry.version === hit.entry.version).filter((c) => {
+          const other = hashOf(c);
+          return hitHash !== void 0 && other !== void 0 && other !== hitHash;
+        }).map((c) => c.library);
         this.warnLibraryCollision(
           `${hit.entry.kind}:@${hit.entry.publisher}/${hit.entry.name}`,
           candidates,
-          hit
+          hit,
+          sameVersionDiffers
         );
       }
       const entry = hit.entry;
@@ -1366,7 +1659,16 @@ var AssetManager = class {
     const roots = [];
     for (const l of (await this.loadLibraryIndex())?.libraries ?? []) {
       if (l.name === GLOBAL_INSTALL_DIR_NAME) continue;
-      if (existsSync(l.path)) roots.push({ name: l.name, dir: l.path, isDefault: l.isDefault });
+      const cfg = l.backendConfig;
+      const publisher = "url" in cfg ? cfg.publisher : void 0;
+      if (existsSync(l.path)) {
+        roots.push({
+          name: l.name,
+          dir: l.path,
+          isDefault: l.isDefault,
+          ...publisher ? { publisher } : {}
+        });
+      }
     }
     const registered = new Set(roots.map((r) => r.name));
     const unregistered = unregisteredLibraryNames();
@@ -1389,8 +1691,8 @@ var AssetManager = class {
     const byKey = /* @__PURE__ */ new Map();
     const libraryDir = new Map(roots.map((r) => [r.name, r.dir]));
     const isDefaultLib = new Map(roots.map((r) => [r.name, r.isDefault]));
-    for (const { name, dir } of roots) {
-      const publisher = readDeclaredPublisher(dir) ?? slugifyAssetName(name);
+    for (const { name, dir, publisher: declared } of roots) {
+      const publisher = readDeclaredPublisher(dir) ?? declared ?? slugifyAssetName(name);
       for (const entry of await scanDirectory(dir, publisher, { knownKinds: this.knownKinds })) {
         const key = `${entry.kind}:@${entry.publisher}/${entry.name}`;
         const list = byKey.get(key);
@@ -1462,11 +1764,19 @@ var AssetManager = class {
    */
   async competingOrigins() {
     const out = /* @__PURE__ */ new Map();
-    for (const [key, origins] of await this.collectOrigins()) {
+    for (const [key, origins] of await this.allOrigins()) {
       if (new Set(origins.map((o) => o.version)).size > 1) out.set(key, origins);
     }
     return out;
   }
+  /**
+   * The origins of {@link refOrigins} for every ref, keyed by `kind:@publisher/name`: the
+   * version in each row is the one `add` locks (a source asset whose file declares none is
+   * `0.0.0-sha.<commit>`), which `search` lists too (p855).
+   */
+  async allOrigins() {
+    return this.collectOrigins();
+  }
   /**
    * The origins of {@link refOrigins} for every ref, or for the one `only` names
    * (`kind:@publisher/name`), keyed by `kind:@publisher/name`.
@@ -1690,11 +2000,11 @@ var AssetManager = class {
    * Warn once when `key` is held by more than one library: names every library
    * with its version and the one chosen, so a silent pick can't surprise.
    */
-  warnLibraryCollision(key, candidates, chosen) {
+  warnLibraryCollision(key, candidates, chosen, differing = []) {
     const libraries = new Set(candidates.map((c) => c.library));
     if (libraries.size < 2) return;
     const held = candidates.map((c) => `${c.library} (${c.entry.version || "unversioned"})`);
-    const msg = `${key} exists in ${libraries.size} libraries: ${held.join(", ")} \u2014 using ${chosen.library} (${chosen.entry.version || "unversioned"}). Highest version wins; an equal version goes to the default library, then by name. Pin a version (${key}#<version>) to choose another.`;
+    const msg = `${key} exists in ${libraries.size} libraries: ${held.join(", ")} \u2014 using ${chosen.library} (${chosen.entry.version || "unversioned"}). Highest version wins; an equal version goes to the default library, then by name. ` + (differing.length > 0 ? `Same version, different content: ${chosen.library} and ${differing.join(", ")} hold ${chosen.entry.version || "unversioned"} with different bytes. ` : "") + `Pin a version (${key}#<version>) to choose another.`;
     if (this.warnedLibraryCollisions.has(msg)) return;
     this.warnedLibraryCollisions.add(msg);
     if (this.onLibraryCollision) this.onLibraryCollision(msg);
@@ -1804,10 +2114,10 @@ var AssetManager = class {
       if (isOwned) continue;
       for (const target of this.targetHarnesses()) {
         const held = deployedPaths(component, a.name, target, this.global, this.projectDir).find(
-          (p) => existsSync(p)
+          pathEntryExists
         );
         if (!held) continue;
-        if (entry && this.deployWouldOnlyRewriteSame(entry, target)) continue;
+        if (entry && !isSymlink(held) && this.deployWouldOnlyRewriteSame(entry, target)) continue;
         const shown = this.global ? held : relative(this.projectDir, held);
         throw new Error(
           `${assetRefToStr({ kind: a.kind, name: a.name, publisher: a.publisher })} would overwrite ${shown}, which no lock entry owns (your own files?) \u2014 move it away, or pass --force to replace it`
@@ -1821,6 +2131,13 @@ var AssetManager = class {
    * markdown file with the same body whose frontmatter the asset's only extends.
    */
   deployWouldOnlyRewriteSame(entry, target) {
+    if (this.installTarget(entry.kind) === "agent") {
+      try {
+        return diffDeployedAgent(entry, { ...this.deployOptsFor(target) }) === "";
+      } catch {
+        return false;
+      }
+    }
     const drift = deployedAssetDrift(entry, {
       registry: this.registry,
       driverTarget: target,
@@ -1887,7 +2204,8 @@ var AssetManager = class {
    * A git-backed library also records its remote URL. When the previous lock names the
    * library under another name that {@link lockedLibrary} matched to this one by URL (a
    * teammate registered the same remote under a different name), the entry keeps the locked
-   * name and URL: the lock does not change because it was installed on another machine.
+   * name and URL: the lock does not change because it was installed on another machine. A
+   * library renamed on this machine with `library rename` is locked under its new name.
    */
   async libraryLockEntries(lib) {
     if (lib.entries.length === 0) return {};
@@ -1912,7 +2230,8 @@ var AssetManager = class {
         })?.[1].library;
         if (locked) {
           const lookup = this.lockedLibrary(locked, snap);
-          if (lookup.state === "ok" && lookup.name === name) {
+          const renamedHere = !locked.url && !url && renamedLibraryName(locked.name) === name;
+          if (lookup.state === "ok" && lookup.name === name && !renamedHere) {
             lockName = locked.name;
             if (locked.url && url && normalizeRepoUrl(locked.url) === normalizeRepoUrl(url)) {
               url = locked.url;
@@ -2038,9 +2357,9 @@ var AssetManager = class {
         );
         continue;
       }
-      const def = newestLibraryDef(snap, lookup.name, { kind, publisher, name });
-      const current = found.version || def?.version || "0.0.0";
-      if (current !== origin.version) {
+      const current = libraryAssetVersion(snap, lookup.name, { kind, publisher, name }, found.version) || "0.0.0";
+      const sameVersion = current === origin.version || isPseudoVersion(current) && isPseudoVersion(origin.version);
+      if (!sameVersion) {
         missing.push(
           `${ref} (library "${lookup.name}" is at ${current}, locked ${origin.version})`
         );
@@ -2055,7 +2374,7 @@ var AssetManager = class {
           continue;
         }
       }
-      found.version = current;
+      found.version = sameVersion ? origin.version : current;
       entries.push(withLibraryFiles(found, libPath, fileSets, this.registry));
     }
     return { entries, missing };
@@ -2562,7 +2881,8 @@ var AssetManager = class {
    *
    * @param opts - Optional installation options.
    * @param opts.locked - When `true`, restore the exact versions recorded in the existing
-   *   lock file instead of resolving from source. Throws if no lock file is found.
+   *   lock file instead of resolving from source. Throws if no lock file is found, unless the
+   *   project declares no dependencies (nothing to restore).
    * @param opts.link - When `true`, symlink local-path assets instead of copying them
    *   (the author dev-loop). Machine-local / not for committing; a no-op for
    *   store/factory sources. Defaults to copy.
@@ -2682,10 +3002,16 @@ var AssetManager = class {
     const deployed = [
       ...new Set(
         this.targetHarnesses().flatMap(
-          (t) => deployAll(entries, repositories, patches, this.deployOptsFor(t, opts?.link))
+          (t) => deployAll(
+            this.entriesForHarness(entries, t),
+            repositories,
+            patches,
+            this.deployOptsFor(t, opts?.link)
+          )
         )
       )
     ];
+    this.sweepLegacyOmpCopies(entries);
     await this.renderDriverMcpConfig();
     const agentRender = await this.renderAgentInstances();
     const restored = this.restoredCopies(copyDrift, deployed, missingCopies);
@@ -2705,10 +3031,12 @@ var AssetManager = class {
     const reportedMissing = stillMissing.filter((m) => !storeNotChecked.some((n) => n.ref === m));
     for (const n of storeNotChecked) delete missingHints[n.ref];
     await this.adviseMissing(reportedMissing, missingHints);
+    const placeholderBodies = scaffoldBodyRefs(lib.entries, deployed);
     return {
       deployed,
       removed,
       missing: reportedMissing,
+      ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       ...storeNotChecked.length > 0 ? { storeNotChecked } : {},
       ...Object.keys(missingHints).length > 0 ? { missingHints } : {},
       ...relocked.length > 0 ? { relocked } : {},
@@ -3093,6 +3421,16 @@ var AssetManager = class {
           npmFailed: []
         };
       }
+      if (dependencies.length === 0) {
+        return {
+          deployed: [],
+          removed: [],
+          missing: [],
+          lockWritten: false,
+          npmInstalled: [],
+          npmFailed: []
+        };
+      }
       throw new Error("No lock file found. Run `skaile install` first.");
     }
     this.assertNoFolderCollision(Object.keys(lock.assets).map(parseCanonicalLockKey));
@@ -3172,7 +3510,7 @@ var AssetManager = class {
       ...new Set(
         this.targetHarnesses().flatMap(
           (t) => deployAll(
-            [...resolved, ...library.entries],
+            this.entriesForHarness([...resolved, ...library.entries], t),
             repositories,
             patches,
             this.deployOptsFor(t)
@@ -3180,6 +3518,7 @@ var AssetManager = class {
         )
       )
     ];
+    this.sweepLegacyOmpCopies([...resolved, ...library.entries]);
     await this.renderDriverMcpConfig();
     const agentRender = await this.renderAgentInstances();
     const restored = this.restoredCopies(copyDrift, deployed, missingCopies);
@@ -3195,10 +3534,12 @@ var AssetManager = class {
       const p = parseRefTolerant(g.ref);
       return !(p && alreadyMissing.has(`${p.kind}:${p.name}`));
     }).map((g) => g.message);
+    const placeholderBodies = scaffoldBodyRefs(library.entries, deployed);
     return {
       deployed,
       removed: [],
       missing: [...library.missing, ...gaps],
+      ...placeholderBodies.length > 0 ? { placeholderBodies } : {},
       lockWritten: false,
       ...restored.length > 0 ? { restored } : {},
       ...rewritten.length > 0 ? { rewritten } : {},
@@ -3339,7 +3680,7 @@ var AssetManager = class {
         );
         if (hit) {
           throw new Error(
-            `${canonicalEntryRef(hit.entry)} is in library "${l.name}" but not listed in its skaile.manifest.yaml, so only part of its files would be deployed. Run \`skaile library index ${l.name}\`, then add it again.`
+            unlistedAssetMessage(canonicalEntryRef(hit.entry), l.name, libPath, l.ownership)
           );
         }
       }
@@ -3366,7 +3707,12 @@ var AssetManager = class {
         const libPath = origin ? this.libraryPath({ name: origin }, snap) : null;
         if (origin && libPath && isUnlistedLibraryAsset(e, libPath)) {
           throw new Error(
-            `${canonicalEntryRef(e)} is in library "${origin}" but not listed in its skaile.manifest.yaml, so only part of its files would be deployed. Run \`skaile library index ${origin}\`, then add it again.`
+            unlistedAssetMessage(
+              canonicalEntryRef(e),
+              origin,
+              libPath,
+              snap?.libraries.find((l) => l.name === origin)?.ownership
+            )
           );
         }
       }
@@ -3410,7 +3756,7 @@ var AssetManager = class {
       ...new Set(
         this.targetHarnesses().flatMap(
           (t) => deployAll(
-            entries,
+            this.entriesForHarness(entries, t),
             repositories,
             patches,
             this.deployOptsFor(t, opts?.link, opts?.onSkippedSymlink, opts?.onEnvFile)
@@ -3418,6 +3764,7 @@ var AssetManager = class {
         )
       )
     ];
+    this.sweepLegacyOmpCopies(entries);
     if (opts?.onLibraryOrigin) {
       for (const e of lib.entries) {
         const origin = lib.libraryOf.get(e);
@@ -3426,6 +3773,9 @@ var AssetManager = class {
       }
     }
     if (presets.length > 0) opts?.onPresets?.(presets);
+    for (const placeholder of scaffoldBodyRefs(lib.entries, deployed)) {
+      opts?.onPlaceholderBody?.(placeholder);
+    }
     this.addDependencyToConfig(ref);
     await this.renderDriverMcpConfig();
     await this.renderAgentInstances();
@@ -3696,8 +4046,9 @@ var AssetManager = class {
    *
    * Deliberately does NOT re-render the driver target's MCP config: the render
    * step is async (the declaration resolver is), and making this synchronous
-   * method async would break every external caller. A removed MCP server's
-   * generated entry is dropped by the next {@link AssetManager.install} — see
+   * method async would break every external caller. {@link removeWithDependencies}
+   * (what `skaile remove` runs) does re-render it; a caller of this method gets the
+   * dropped entry at the next {@link AssetManager.install} — see
    * {@link renderMcpServerConfig}.
    *
    * @param ref - Asset ref: `kind:@publisher/name`, or the short `kind:name` /
@@ -3761,10 +4112,17 @@ var AssetManager = class {
       });
     }
     const kept = [];
-    const changed = this.removeResolved(target, { force: opts?.force, kept });
-    const keptNote = kept.length > 0 ? { kept } : {};
-    if (!changed || requiredRefs.length === 0) return { changed, pruned: [], ...keptNote };
-    return { changed, pruned: await this.pruneOrphans(requiredRefs), ...keptNote };
+    const ownedBy = [];
+    const changed = this.removeResolved(target, { force: opts?.force, kept, ownedBy });
+    const keptNote = {
+      ...kept.length > 0 ? { kept } : {},
+      ...ownedBy.length > 0 ? { ownedBy } : {}
+    };
+    const pruned = changed && requiredRefs.length > 0 ? await this.pruneOrphans(requiredRefs) : [];
+    if (changed && (target.kind === "mcp-server" || pruned.some((r) => r.startsWith("mcp-server:")))) {
+      await this.renderDriverMcpConfig();
+    }
+    return { changed, pruned, ...keptNote };
   }
   /**
    * Resolve the identity {@link remove} acts on. A publisher-qualified ref is taken
@@ -3859,15 +4217,24 @@ var AssetManager = class {
     }
     return found;
   }
-  /** Whether a lock entry holds `kind:name` (any publisher): the deployed folder is then the project's copy of it. */
-  lockHolds(kind, name) {
-    return Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).some((id) => id.kind === kind && id.name === name);
+  /**
+   * The lock entries that hold `kind:name`, each with its publisher (no leading `@`) and its
+   * canonical ref. A deployed folder carries no publisher; these are who it belongs to.
+   */
+  lockHolders(kind, name) {
+    return Object.keys(this.tryReadLock()?.assets ?? {}).map(parseCanonicalLockKey).filter((id) => id.kind === kind && id.name === name).map((id) => {
+      const publisher = id.publisher?.replace(/^@/, "");
+      return {
+        publisher,
+        ref: publisher ? assetRefToStr({ kind, name, publisher }) : `${kind}:${name}`
+      };
+    });
   }
   /** The folders or files of `kind:name` on disk in `target`, shown relative to the project. */
   heldDeployPaths(kind, name, target) {
     const component = this.installTarget(kind);
     if (!component) return [];
-    return deployedPaths(component, name, target, this.global, this.projectDir).filter((p) => existsSync(p)).map((p) => this.global ? p : relative(this.projectDir, p));
+    return deployedPaths(component, name, target, this.global, this.projectDir).filter(pathEntryExists).map((p) => this.global ? p : relative(this.projectDir, p));
   }
   /**
    * Undeploy `parsed` from every target harness and drop its declaration and lock entry.
@@ -3878,21 +4245,34 @@ var AssetManager = class {
   removeResolved(parsed, opts = {}) {
     const wantPub = parsed.publisher?.replace(/^@/, "");
     const tracked = this.trackedPublishers(parsed.kind, parsed.name);
+    const holders = this.lockHolders(parsed.kind, parsed.name);
+    const ownHolder = holders.some(
+      (h) => wantPub === void 0 || !h.publisher || h.publisher === wantPub
+    );
+    const otherHolders = ownHolder ? [] : holders;
     const someoneElses = wantPub !== void 0 && tracked.size > 0 && !tracked.has(wantPub) && !tracked.has(void 0);
-    const owned = opts.force === true || this.lockHolds(parsed.kind, parsed.name);
+    const owned = opts.force === true || ownHolder;
     let undeployed = false;
-    if (!someoneElses) {
+    if (!someoneElses || otherHolders.length > 0) {
       for (const t of this.targetHarnesses()) {
         if (!owned) {
-          opts.kept?.push(...this.heldDeployPaths(parsed.kind, parsed.name, t));
+          const held = this.heldDeployPaths(parsed.kind, parsed.name, t);
+          if (otherHolders.length > 0) {
+            if (held.length > 0)
+              opts.ownedBy?.push({ refs: otherHolders.map((h) => h.ref), paths: held });
+          } else {
+            opts.kept?.push(...held);
+          }
           continue;
         }
         if (removeAsset(parsed.kind, parsed.name, this.deployOptsFor(t))) undeployed = true;
       }
     }
-    const undeclared = this.removeDependencyFromConfig(parsed);
+    const stillHeldBy = this.harnessesStillHolding(parsed);
+    const undeclared = stillHeldBy ? false : this.removeDependencyFromConfig(parsed);
+    if (stillHeldBy) this.limitDeclaredEntry(parsed, stillHeldBy);
     const unbound = this.removeAgentBindings(parsed);
-    const unlocked = undeployed || undeclared || unbound ? this.pruneLockEntry(parsed) : false;
+    const unlocked = !stillHeldBy && (undeployed || undeclared || unbound) ? this.pruneLockEntry(parsed) : false;
     const changed = undeployed || undeclared || unbound || unlocked;
     if (changed) {
       appendHistory(this.projectDir, {
@@ -3904,6 +4284,29 @@ var AssetManager = class {
     }
     return changed;
   }
+  /**
+   * After `remove --global --harness X`: the harnesses outside `X` that still hold a copy of the
+   * asset, or `undefined` when none does (or this is not a harness-limited global remove).
+   */
+  harnessesStillHolding(target) {
+    if (!this.global || !this.harnessesOverride?.length) return void 0;
+    const component = this.installTarget(target.kind);
+    if (!component) return void 0;
+    const current = this.entryHarnessRecord(target.kind, target.name, target.publisher) ?? this.defaultGlobalHarnesses();
+    const left = current.filter((h) => !this.harnessesOverride?.includes(h));
+    const holding = left.filter((h) => isDeployed(component, target.name, h, true));
+    return holding.length > 0 ? holding : void 0;
+  }
+  /** Limit the declared global entry of `target` to `harnesses` (`~/.skaile/skaile.yaml`). */
+  limitDeclaredEntry(target, harnesses) {
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return;
+    const raw = parse(readFileSync(configPath, "utf8")) ?? {};
+    const ref = assetRefToStr(target);
+    if (this.setEntryHarnessRow(raw, ref, harnesses)) {
+      writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
+    }
+  }
   /**
    * Drop the locked assets among `requiredRefs` (and what they require in turn) that
    * nothing needs any more: not declared in `skaile.yaml`, not required by a locked
@@ -3965,7 +4368,7 @@ var AssetManager = class {
         changed = true;
       }
     }
-    if (changed) writeLock(this.lockPath, lock);
+    if (changed) writeLock(this.lockPath, resyncLockSources(lock));
     return changed;
   }
   // ── Query ──────────────────────────────────────────────────────────────
@@ -4039,9 +4442,11 @@ var AssetManager = class {
         knownKinds: this.knownKinds,
         declaredPublisher: decl.publisher
       });
-      const match = entries.find(
+      let match = entries.find(
         (e) => e.kind === parsed.kind && e.name === parsed.name && (!parsed.publisher || e.publisher === parsed.publisher)
       );
+      const commit = match && !match.version ? getRepoCommit(repoDir) : null;
+      if (match && commit) match = { ...match, version: `0.0.0-sha.${commit.slice(0, 7)}` };
       if (match && (!best || gt(coerceVersion(match.version ?? ""), coerceVersion(best.version ?? "")))) {
         best = match;
       }
@@ -4320,7 +4725,8 @@ var AssetManager = class {
       const locked = parsed.kind === "preset" ? lock !== null : lockKeys.some(
         (k) => k.kind === parsed.kind && k.name === parsed.name && (!parsed.publisher || k.publisher === parsed.publisher)
       );
-      for (const harness of harnesses) {
+      const recorded = this.entryHarnessRecord(parsed.kind, parsed.name, parsed.publisher);
+      for (const harness of recorded ? harnesses.filter((h) => recorded.includes(h)) : harnesses) {
         let state;
         if (!locked) {
           state = "declared";
@@ -4427,6 +4833,7 @@ var AssetManager = class {
       declared = this.loadConfig().dependencies;
     } catch {
     }
+    declared = [...declared, ...this.declaredAgentInstanceRefs()];
     for (const dep of declared) {
       const key = findKey(dep);
       if (key) {
@@ -4652,8 +5059,13 @@ var AssetManager = class {
         }
         const found = scanned.find((x) => x.kind === kind && x.name === name);
         if (!found) continue;
-        const diskVersion = found.version || newestLibraryDef(snap, lookup.name, { kind, publisher, name })?.version;
-        if (diskVersion && gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
+        const diskVersion = libraryAssetVersion(
+          snap,
+          lookup.name,
+          { kind, publisher, name },
+          found.version
+        );
+        if (diskVersion && !isPseudoVersion(diskVersion) && gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
           result.push({
             kind,
             name,
@@ -4684,8 +5096,56 @@ var AssetManager = class {
       }
       await this.addLibraryMoves(libraryAssets, result);
     }
+    await this.addRekeyRows(lock, result);
     return this.addLockGapRows(result);
   }
+  /**
+   * List a source asset locked under a `0.0.0-sha.<commit>` key whose file now declares a
+   * version: the next `install` or `update` re-keys it (`replaced 0.0.0-sha.7de3555 → 0.2.0`),
+   * so `outdated` lists it as `re-key (…)` instead of saying everything is up to date (p914).
+   * An asset already listed (behind its remote) gets the target on that row.
+   */
+  async addRekeyRows(lock, rows) {
+    const sha = Object.entries(lock.assets).filter(
+      ([key, e]) => e.source && parseCanonicalLockKey(key).version?.startsWith("0.0.0-sha.")
+    );
+    if (sha.length === 0) return;
+    const { repositories } = this.loadConfig();
+    let index;
+    try {
+      index = await buildProvenanceIndex(this.buildClones(repositories), {
+        projectDir: this.projectDir,
+        knownKinds: this.knownKinds,
+        onSourceError: () => void 0
+      });
+    } catch {
+      return;
+    }
+    for (const [key, entry] of sha) {
+      const { publisher, kind, name, version } = parseCanonicalLockKey(key);
+      if (!publisher || !kind || !name || !version || !entry.source) continue;
+      const url = normalizeRepoUrl(entry.source.url);
+      const now = (index.get(`${publisher}/${kind}:${name}`) ?? []).find(
+        (c) => normalizeRepoUrl(c.sourceUrl) === url
+      );
+      if (!now || now.version === version || now.version.startsWith("0.0.0-sha.")) continue;
+      const row = rows.find(
+        (r) => r.kind === kind && r.name === name && r.publisher.replace(/^@/, "") === publisher
+      );
+      if (row) {
+        row.rekeyTo = now.version;
+        continue;
+      }
+      rows.push({
+        kind,
+        name,
+        publisher,
+        currentVersion: version,
+        behind: 0,
+        rekeyTo: now.version
+      });
+    }
+  }
   /**
    * List a locked library asset that `update` would move to another library (a default-library
    * switch, a library that now holds a newer version) as `library → movesTo`, so `outdated`
@@ -4723,6 +5183,7 @@ var AssetManager = class {
         (r) => r.kind === e.kind && r.name === e.name && r.publisher.replace(/^@/, "") === publisher
       );
       if (row) {
+        row.library = from.name;
         row.movesTo = to;
         continue;
       }
@@ -4850,8 +5311,13 @@ var AssetManager = class {
     if (parsed.kind === "preset" && this.presetRecorded(parsed)) return { status: "no-files" };
     if (!component) return { status: "not-deployed" };
     if (component === "agent") {
-      const diff = diffDeployedAgent(entry, this.deployOptsFor(this.driverTarget));
-      if (diff === null) return { status: "not-deployed" };
+      const opts = this.deployOptsFor(this.driverTarget);
+      const parts = [diffDeployedAgent(entry, opts)];
+      for (const inst of this.instancesBoundTo(parsed)) {
+        parts.push(diffDeployedAgent(entry, opts, inst));
+      }
+      if (parts.every((d) => d === null)) return { status: "not-deployed" };
+      const diff = parts.filter((d) => d !== null).join("");
       return diff === "" ? { status: "identical" } : { status: "differs", diff };
     }
     const deployedPath = join(
@@ -4874,6 +5340,33 @@ var AssetManager = class {
     }
     return diffs.length > 0 ? { status: "differs", diff: diffs.join("") } : { status: "identical" };
   }
+  /**
+   * The agent instances of `skaile.yaml` whose `ref` names `want` (an `agent:` ref, matched on
+   * name and, when both name one, publisher) and bind to an agent definition directory.
+   */
+  instancesBoundTo(want) {
+    if (this.global) return [];
+    let instances;
+    try {
+      instances = effectiveAgentInstances(resolveSkWorkspaceConfig(this.projectDir));
+    } catch {
+      return [];
+    }
+    const out = [];
+    for (const [id, config] of Object.entries(instances)) {
+      const ref = parseRefTolerant(config.ref);
+      if (!ref || ref.kind !== "agent" || ref.name !== want.name) continue;
+      const refPublisher = ref.publisher?.replace(/^@/, "");
+      const wantPublisher = want.publisher?.replace(/^@/, "");
+      if (refPublisher && wantPublisher && refPublisher !== wantPublisher) continue;
+      try {
+        const srcDir = resolveAgentDefinitionDir(this.projectDir, config.ref);
+        if (srcDir !== void 0) out.push({ id, srcDir, config });
+      } catch {
+      }
+    }
+    return out;
+  }
   // ── Lock ───────────────────────────────────────────────────────────────
   /**
    * Resolve all declared dependencies and write (or overwrite) `skaile.lock.yaml`.
@@ -5199,7 +5692,10 @@ var AssetManager = class {
     for (const d of await this.lockedCopyDrift()) {
       if (named.has(gapIdentity(d.ref))) continue;
       const parts = [
-        ...d.modified.map((f) => `${f} was edited`),
+        ...d.modified.map((f) => {
+          const instance = d.instanceOf?.get(f);
+          return instance ? `${f}, the file of agent instance "${instance}", was edited` : `${f} was edited`;
+        }),
         ...d.extra.map((f) => `${f} is not part of the asset`)
       ];
       const reason = `is locked, but its deployed copy differs from the lock (${parts.join("; ")}) \u2014 run \`skaile install --locked\` to restore it`;
@@ -5413,8 +5909,13 @@ var AssetManager = class {
         if (found) {
           const onDisk = origin.sha256 ? libraryDiskHashes(libPath, diskHashes, this.registry).get(`${kind}:${name}`) : void 0;
           if (onDisk !== void 0 && onDisk !== origin.sha256) {
-            const diskVersion = found.version || newestLibraryDef(snap, lookup.name, { kind, publisher, name })?.version;
-            if (!diskVersion || !gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
+            const diskVersion = libraryAssetVersion(
+              snap,
+              lookup.name,
+              { kind, publisher, name },
+              found.version
+            );
+            if (!diskVersion || isPseudoVersion(diskVersion) || !gt(coerceVersion(diskVersion), coerceVersion(origin.version))) {
               const reason2 = `is locked, but library "${lookup.name}" content changed since lock \u2014 or the lock predates the one shared asset hash; run \`skaile install\` to re-lock it`;
               gaps.push({ type: "content", ref, reason: reason2, message: `${ref} ${reason2}` });
             }
@@ -5694,7 +6195,8 @@ var AssetManager = class {
         continue;
       }
       const modified = [];
-      for (const f of lockedAssetFiles(kind, entry.files)) {
+      const locked = lockedAssetFiles(kind, entry.files);
+      for (const f of locked) {
         const deployedFile = join(dest, f.rel);
         if (!existsSync(deployedFile)) continue;
         try {
@@ -5703,8 +6205,14 @@ var AssetManager = class {
           modified.push(f.rel);
         }
       }
-      if (modified.length > 0)
-        out.push({ ref: refOf(key), key, modified, extra: [], library: false });
+      const covered = new Set(locked.map((f) => f.rel));
+      let extra = [];
+      try {
+        extra = listAssetFiles(dest).filter((rel) => !covered.has(rel));
+      } catch {
+      }
+      if (modified.length > 0 || extra.length > 0)
+        out.push({ ref: refOf(key), key, modified, extra, library: false });
     }
     for (const [key, entry] of Object.entries(lock.assets)) {
       if (!entry.rendered || entry.rendered.length === 0 || entry.library?.installed) continue;
@@ -5722,6 +6230,10 @@ var AssetManager = class {
         }
       }
       if (modified.length > 0) {
+        const instanceOf = /* @__PURE__ */ new Map();
+        for (const inst of renderedInstanceFiles(this.projectDir, this.driverTarget)) {
+          for (const f of inst.files) if (modified.includes(f)) instanceOf.set(f, inst.id);
+        }
         out.push({
           ref: refOf(key),
           key,
@@ -5729,7 +6241,8 @@ var AssetManager = class {
           extra: [],
           library: false,
           rendered: true,
-          lockedSha: new Map(entry.rendered.map((f) => [f.path, f.sha256]))
+          lockedSha: new Map(entry.rendered.map((f) => [f.path, f.sha256])),
+          instanceOf
         });
       }
     }
@@ -6009,6 +6522,7 @@ var AssetManager = class {
    *   and `unmanaged` (deployed assets not in the lock file).
    */
   clean(opts) {
+    if (this.global) return this.cleanGlobal(opts);
     const lock = this.tryReadLock();
     const skipped = [];
     const removed = this.cleanLockedDeployedAssets(lock);
@@ -6016,6 +6530,42 @@ var AssetManager = class {
     if (opts?.all) this.removeAllManagedState();
     return { removed, skipped, unmanaged };
   }
+  /**
+   * `clean --global`: remove the copy of every asset the global lock tracks from each global
+   * harness (and the old `~/.omp/<dir>` copy), keeping `~/.skaile/skaile.yaml`. With `all`, the
+   * global lock goes too.
+   */
+  cleanGlobal(opts) {
+    const lock = this.tryReadLock();
+    const removed = [];
+    const stale = this.staleLegacyOmpCopies();
+    for (const key of Object.keys(lock?.assets ?? {})) {
+      const { kind, name } = parseCanonicalLockKey(key);
+      const component = kind ? this.installTarget(kind) : void 0;
+      if (!kind || !name || !component) continue;
+      const paths = [
+        ...this.targetHarnesses().flatMap(
+          (t) => deployedPaths(component, name, t, true, this.projectDir)
+        ),
+        ...stale.filter((s) => s.ref === key).map((s) => s.path)
+      ];
+      for (const dest of paths) {
+        try {
+          if (lstatSync(dest).isSymbolicLink()) unlinkSync(dest);
+          else rmSync(dest, { recursive: true, force: true });
+        } catch {
+        }
+      }
+      removed.push(key);
+    }
+    if (opts?.all) {
+      try {
+        unlinkSync(this.lockPath);
+      } catch {
+      }
+    }
+    return { removed, skipped: [], unmanaged: [] };
+  }
   /**
    * Remove the deployed dir of every asset tracked by the lock; missing dirs
    * still count as removed. Returns the list of cleaned refs.
@@ -6095,16 +6645,21 @@ var AssetManager = class {
    */
   addDependencyToConfig(ref) {
     const configPath = join(this.stateRoot, "skaile.yaml");
+    const limit = this.global && this.harnessesOverride?.length ? this.harnessesOverride : void 0;
     if (!existsSync(configPath)) {
       if (!this.global) return;
       mkdirSync(this.stateRoot, { recursive: true });
-      writeFileSync(configPath, stringify({ dependencies: [ref] }, { lineWidth: 120 }));
+      const fresh = { dependencies: [ref] };
+      if (limit) this.setEntryHarnessRow(fresh, ref, limit);
+      writeFileSync(configPath, stringify(fresh, { lineWidth: 120 }));
       return;
     }
     const raw = parse(readFileSync(configPath, "utf8")) ?? {};
     if (!Array.isArray(raw.dependencies)) raw.dependencies = [];
     const deps = raw.dependencies;
+    const limitChanged = this.global ? this.setEntryHarnessRow(raw, ref, limit) : false;
     if (deps.includes(ref) && deps.filter((d) => this.sameDeclaredAsset(d, ref)).length === 1) {
+      if (limitChanged) writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
       return;
     }
     const next = [];
@@ -6156,9 +6711,26 @@ var AssetManager = class {
       return !(wantPub === void 0 || havePub === void 0 || havePub === wantPub);
     });
     if (raw.dependencies.length === before) return false;
+    if (this.global) this.setEntryHarnessRow(raw, assetRefToStr(target), void 0);
     writeFileSync(configPath, stringify(raw, { lineWidth: 120 }));
     return true;
   }
+  /** The refs `skaile.yaml` binds agent instances to: every `agents.<id>.ref` and `agent.definition`. Project mode only. */
+  declaredAgentInstanceRefs() {
+    if (this.global) return [];
+    const configPath = join(this.stateRoot, "skaile.yaml");
+    if (!existsSync(configPath)) return [];
+    try {
+      const raw = parse(readFileSync(configPath, "utf8"));
+      const refs = [
+        ...Object.values(raw?.agents ?? {}).map((i) => i?.ref),
+        raw?.agent?.definition
+      ];
+      return refs.filter((r) => typeof r === "string");
+    } catch {
+      return [];
+    }
+  }
   /**
    * Drop the agent instances of `skaile.yaml` (`agents.<id>`, or the `agent.definition`
    * default) whose `ref` binds to `target`, and the native agent files an install rendered for
@@ -6225,5 +6797,5 @@ var AssetManager = class {
 };
 
 export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, installAgentInstances, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName };
-//# sourceMappingURL=chunk-R37L4BNR.js.map
-//# sourceMappingURL=chunk-R37L4BNR.js.map
+//# sourceMappingURL=chunk-W44KA24A.js.map
+//# sourceMappingURL=chunk-W44KA24A.js.map